I'm thinking we could use https://verdaccio.org rather than mocking so we're actually testing against a real npm registry.

I've done a little bit of looking and it seems as though verdaccio doesn't support 2fa so we couldn't test that but we could at least test the core publishing flow.